LINUX.IE, website of the Irish Linux Users' Group
Tux rules!

   
Home
New Users
Articles
Download
Projects
Community
Vendors

  Print Version
Email to...
 
Archives:


planetILUG

Recent News

News Archive


Join the
ILUG
on FaceBook


Join the
ILUG
on LinkedIn


Join the
ILUG SETI
Group



















 
 :: Mailing Lists

[ILUG] (no subject)

[ILUG] (no subject)

Garth Fitzmaurice garth at fitzmaurice.ie
Sun Apr 15 02:01:13 IST 2001 

On Sat, Apr 14, 2001 at 11:09:00AM -0700, Chris Boyd wrote:
> Can anyone tell me what's going on here. A bit new to
> the security thing and not sure what steps to take at
> this point. How can I tell if they got in or is an
> actual attack. 

 What's going on is that someone scanned your machine. You are using portsentry which saw this and then blocked the host by dropping the route. These entries appear in your logfiles (probably /var/log/messages) and you are using the logcheck.sh script which sent the mail to you. Scans like this are common and dropping the route for every single scan may not be what you want. Visit the homepage of portsentry to find out more about it (I cant remember the URL, but http://freshmeat.net/projects/portsentry probably would give it to you). You may want to consider using snort (www.snort.org) instead of portsentry. It is a much better Intrusion Detection System. There's a very good article on the linux.ie site comparing snort and portsentry if you are interested.

 Regards,
  Garth

> 
> Active System Attack Alerts
> =-=-=-=-=-=-=-=-=-=-=-=-=-=
> Apr 13 22:16:43 myserver portsentry[693]: attackalert:
> SYN/Normal scan 
> from host: ppp2037.ath.forthnet.gr/212.251.58.142 to
> TCP port: 37
> Apr 13 22:16:43 myserver portsentry[693]: attackalert:
> Host 
> 212.251.58.142 has been blocked via wrappers with
> string: "ALL: 212.251.58.142"
> Apr 13 22:16:43 myserver portsentry[693]: attackalert:
> Host 
> 212.251.58.142 has been blocked via dropped route
> using command: "/sbin/ipchains 
> -I input -s 212.251.58.142 -j DENY -l"
> 
> Security Violations
> =-=-=-=-=-=-=-=-=-=
> Apr 13 22:16:43 myserver portsentry[693]: attackalert:
> SYN/Normal scan 
> from host: ppp2037.ath.forthnet.gr/212.251.58.142 to
> TCP port: 37
> Apr 13 22:16:43 myserver portsentry[693]: attackalert:
> Host 
> 212.251.58.142 has been blocked via wrappers with
> string: "ALL: 212.251.58.142"
> Apr 13 22:16:43 myserver kernel: Packet log: input
> DENY eth0 PROTO=6 
> 212.251.58.142:1767 myserver:80 L=40 S=0x00 I=16533
> F=0x0000 T=83 
> Apr 13 22:16:43  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1769 x:80 L=40 S=0x00 I=16534 F=0x0000
> T=83 
> Apr 13 22:16:43  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1769 x:80 L=40 S=0x00 I=16535 F=0x0000
> T=83 
> Apr 13 22:16:43  portsentry[693]: attackalert: Host 
> 212.251.58.142 has been blocked via dropped route
> using command: "/sbin/ipchains 
> -I input -s 212.251.58.142 -j DENY -l"
> Apr 13 22:16:43  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1775 x:37 L=44 S=0x00 I=16536 F=0x0000
> T=83 
> Apr 13 22:16:44  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1769 x:80 L=40 S=0x00 I=16538 F=0x0000
> T=83 
> Apr 13 22:16:44  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1768 x:80 L=40 S=0x00 I=16539 F=0x0000
> T=83 
> Apr 13 22:16:44  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1768 x:80 L=40 S=0x00 I=16540 F=0x0000
> T=83 
> Apr 13 22:16:44  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1775 x:37 L=44 S=0x00 I=16541 F=0x0000
> T=83 
> Apr 13 22:16:44  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1768 x:80 L=40 S=0x00 I=16542 F=0x0000
> T=83 
> Apr 13 22:16:44  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1766 x:80 L=40 S=0x00 I=16543 F=0x0000
> T=83 
> Apr 13 22:16:45  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1776 x:80 L=44 S=0x00 I=16551 F=0x0000
> T=83 
> Apr 13 22:16:45  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1767 x:80 L=40 S=0x00 I=16552 F=0x0000
> T=83 
> Apr 13 22:16:46  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1767 x:80 L=40 S=0x00 I=16553 F=0x0000
> T=83 
> Apr 13 22:16:46  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1774 x:80 L=40 S=0x00 I=16554 F=0x0000
> T=83 
> Apr 13 22:16:46  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1776 x:80 L=44 S=0x00 I=16559 F=0x0000
> T=83 
> Apr 13 22:16:47  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1775 x:37 L=44 S=0x00 I=16560 F=0x0000
> T=83 
> Apr 13 22:16:47  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1776 x:80 L=44 S=0x00 I=16562 F=0x0000
> T=83 
> Apr 13 22:16:48  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1774 x:80 L=40 S=0x00 I=16563 F=0x0000
> T=83 
> Apr 13 22:16:48  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1775 x:37 L=44 S=0x00 I=16564 F=0x0000
> T=83 
> Apr 13 22:16:49  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1776 x:80 L=44 S=0x00 I=16565 F=0x0000
> T=83 
> Apr 13 22:16:49  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1767 x:80 L=40 S=0x00 I=16566 F=0x0000
> T=83 
> Apr 13 22:16:50  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1769 x:80 L=40 S=0x00 I=16567 F=0x0000
> T=83 
> Apr 13 22:16:50  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1776 x:80 L=44 S=0x00 I=16568 F=0x0000
> T=83 
> Apr 13 22:16:51  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1775 x:37 L=44 S=0x00 I=16569 F=0x0000
> T=83 
> Apr 13 22:16:51  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1768 x:80 L=40 S=0x00 I=16570 F=0x0000
> T=83 
> Apr 13 22:16:52  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1776 x:80 L=44 S=0x00 I=16571 F=0x0000
> T=83 
> Apr 13 22:16:53  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1774 x:80 L=40 S=0x00 I=16572 F=0x0000
> T=83 
> Apr 13 22:16:53  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1775 x:37 L=44 S=0x00 I=16573 F=0x0000
> T=83 
> Apr 13 22:16:55  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1776 x:80 L=44 S=0x00 I=16574 F=0x0000
> T=83 
> Apr 13 22:16:59  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1775 x:37 L=44 S=0x00 I=16576 F=0x0000
> T=83 
> Apr 13 22:17:00  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1767 x:80 L=40 S=0x00 I=16577 F=0x0000
> T=83 
> Apr 13 22:17:01  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1776 x:80 L=44 S=0x00 I=16578 F=0x0000
> T=83 
> Apr 13 22:17:02  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1769 x:80 L=40 S=0x00 I=16579 F=0x0000
> T=83 
> Apr 13 22:17:03  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1777 x:13 L=44 S=0x00 I=16580 F=0x0000
> T=83 
> Apr 13 22:17:03  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1777 x:13 L=44 S=0x00 I=16581 F=0x0000
> T=83 
> Apr 13 22:17:04  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1768 x:80 L=40 S=0x00 I=16582 F=0x0000
> T=83 
> Apr 13 22:17:05  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1777 x:13 L=44 S=0x00 I=16583 F=0x0000
> T=83 
> Apr 13 22:17:05  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1777 x:13 L=44 S=0x00 I=16584 F=0x0000
> T=83 
> Apr 13 22:17:06  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1774 x:80 L=40 S=0x00 I=16585 F=0x0000
> T=83 
> Apr 13 22:17:07  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1777 x:13 L=44 S=0x00 I=16586 F=0x0000
> T=83 
> Apr 13 22:17:09  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1776 x:80 L=44 S=0x00 I=16587 F=0x0000
> T=83 
> Apr 13 22:17:09  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1777 x:13 L=44 S=0x00 I=16588 F=0x0000
> T=83 
> Apr 13 22:17:13  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1777 x:13 L=44 S=0x00 I=16589 F=0x0000
> T=83 
> Apr 13 22:17:15  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1778 x:80 L=44 S=0x00 I=16590 F=0x0000
> T=83 
> Apr 13 22:17:15  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1778 x:80 L=44 S=0x00 I=16591 F=0x0000
> T=83 
> Apr 13 22:17:16  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1778 x:80 L=44 S=0x00 I=16592 F=0x0000
> T=83 
> Apr 13 22:17:17  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1778 x:80 L=44 S=0x00 I=16593 F=0x0000
> T=83 
> Apr 13 22:17:19  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1777 x:13 L=44 S=0x00 I=16594 F=0x0000
> T=83 
> Apr 13 22:17:19  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1778 x:80 L=44 S=0x00 I=16595 F=0x0000
> T=83 
> Apr 13 22:17:21  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1778 x:80 L=44 S=0x00 I=16596 F=0x0000
> T=83 
> Apr 13 22:17:25  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1778 x:80 L=44 S=0x00 I=16597 F=0x0000
> T=83 
> Apr 13 22:17:25  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1767 x:80 L=40 S=0x00 I=16598 F=0x0000
> T=83 
> Apr 13 22:17:28  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1769 x:80 L=40 S=0x00 I=16599 F=0x0000
> T=83 
> Apr 13 22:17:30  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1774 x:80 L=40 S=0x00 I=16600 F=0x0000
> T=83 
> Apr 13 22:17:30  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1778 x:80 L=44 S=0x00 I=16602 F=0x0000
> T=83 
> Apr 13 22:17:33  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1768 x:80 L=40 S=0x00 I=16603 F=0x0000
> T=83 
> Apr 13 22:17:39  kernel: Packet log: input DENY eth0
> PROTO=6 
> 212.251.58.142:1778 x:80 L=44 S=0x00 I=16604 F=0x0000
> T=83 
> Apr 13 22:17:44  kernel: Packet log: input DENY eth0
> PROTO=6 
> 
> 
> =====
> Chris Boyd
> 
> Home: (01)671 9858
> Cell: 087 955 9519
> 
> __________________________________________________
> Do You Yahoo!?
> Get email at your own domain with Yahoo! Mail. 
> http://personal.mail.yahoo.com/
> 
> -- 
> Irish Linux Users' Group: ilug at linux.ie
> http://www.linux.ie/mailman/listinfo/ilug for (un)subscription information.
> List maintainer: listmaster at linux.ie

More information about the ILUG mailing list
Read this without the formatting.
                                                                                                    

  

Hosted by HEAnet


 Maintained by the ILUG website team. The aim of Linux.ie is to support and help commercial and private users of Linux in Ireland. You can display ILUG news in your own webpages, read backend information to find out how. Networking services kindly provided by HEAnet, server kindly donated by Dell. Linux is a trademark of Linus Torvalds, used with permission. No penguins were harmed in the production or maintenance of this highly praised website. Looking for the Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
RSS Version
Powered by Dell